Detection Of Covert Timing Channels Research Articles

A generalized detection framework for covert timing channels based on perceptual hashing

AbstractNetwork covert channels use network resources to transmit data covertly, and their existence will seriously threaten network security. Therefore, an effective method is needed to prevent and detect them. Current network covert timing channel detection methods often incorporate machine learning methods in order to achieve generalized detection, but they consume a large amount of computational resources. In this paper, we propose a generalized detection framework for covert channels based on perceptual hashing without relying on machine learning methods. And we propose a one‐dimensional data feature descriptor for feature extraction of perceptual hash for the data characteristics of covert timing channels. We first generate the hash sequence of the corresponding channel to get the average hash, which is used for comparison in the test phase. The experimental results show that the feature descriptor can capture the feature differences of one‐dimensional data well. When compared to machine learning methods, this perceptual hashing algorithms enable faster traffic detection. Meanwhile, our method is able to detect the effectiveness with the smallest coverage window compared with the latest solutions. Moreover, it exhibits robustness in jitter network environment.

Covert Timing Channels Detection Based on Auxiliary Classifier Generative Adversarial Network

Covert timing channels (CTCs) are defined as a mechanism that embeds covert information into network traffic. In a manner, information leakage caused by CTCs brings serious threat to network security. In recent years, detection of CTCs is a focus and a challenging task in the field of covert channel research. However, existing detection schemes based on statistical methods have poor performance in detecting multiple CTCs, and require so many inter-arrival times of packets that these schemes cannot detect CTCs in real time. In this paper, we propose a novel deep learning approach for CTCs detection, namely, covert timing channels detection based on auxiliary classifier generative adversarial network (CD-ACGAN). The network structure and loss function of CD-ACGAN are designed to be suitable for CTCs detection task. We first encode traffic flows into single-channel Gramian Angular Field (GAF) images. Then we use CD-ACGAN to learn features from GAF images and predict the classes of CTCs. Our experimental results show that our approach has high accuracy and strong robustness in detecting various CTCs.

SnapCatch: Automatic Detection of Covert Timing Channels Using Image Processing and Machine Learning

With the rapid growth of data exfiltration carried out by cyber attacks, Covert Timing Channels (CTC) have become an imminent network security risk that continues to grow in both sophistication and utilization. These types of channels utilize inter-arrival times to steal sensitive data from the targeted networks. CTC detection relies increasingly on machine learning techniques, which utilize statistical-based metrics to separate malicious (covert) traffic flows from the legitimate (overt) ones. However, given the efforts of cyber attacks to evade detection and the growing column of CTC, covert channels detection needs to improve in both performance and precision to detect and prevent CTCs and mitigate the reduction of the quality of service caused by the detection process. In this article, we present an innovative image-based solution for fully automated CTC detection and localization. Our approach is based on the observation that the covert channels generate traffic that can be converted to colored images. Leveraging this observation, our solution is designed to automatically detect and locate the malicious part (i.e., set of packets) within a traffic flow. By locating the covert parts within traffic flows, our approach reduces the drop of the quality of service caused by blocking the entire traffic flows in which covert channels are detected. We first convert traffic flows into colored images, and then we extract image-based features for detection covert traffic. We train a classifier using these features on a large data set of covert and overt traffic. This approach demonstrates a remarkable performance achieving a detection accuracy of 95.83% for cautious CTCs and a covert traffic accuracy of 97.83% for 8 bit covert messages, which is way beyond what the popular statistical-based solutions can achieve.

Covert timing channel detection method based on time interval and payload length analysis

Information leakage is becoming increasingly serious in today’ s network environment. Faced with increasingly forceful network defence strategies, attackers are also constantly trying to steal important information from systems. As for security researchers, the most troublesome way of information stealing is the covert channel. Generally, the covert channel is divided into the covert storage channel (CSC) and the covert timing channel (CTC). For the covert storage channel, there are already many effective methods to detect it. However, the detection of the covert timing channel is still in the research stage. The basis for implementing the covert timing channel is to control the sending time of packets, so most researches about the covert timing channel detection are based on the time interval between packets. Based on this idea, we refer to the method adopted in the researches of the malicious traffic detection and propose a covert timing channel detection method based on the k-NearestNeighbor (kNN) algorithm. This method uses a series of statistics related to the time interval and payload length as features to train a machine learning model and using 10-fold cross-validation to improve model performance. The experiment result proves that the model has a great detection effect, the detection accuracy is 0.96, and the Area Under Curve (AUC) value the model is 0.9737.

A network covert timing channel detection method based on threshold secret sharing

AbstractNetwork covert timing channel (NCTC) is a kind of covert channel that acquires strong concealment by modifying the interpacket delays of legitimate network traffic and can evade detection by conventional network security mechanisms such as firewalls. Existing detection schemes are not able to detect multiple types of covert channels. Moreover, the robustness of the detection method is low when the network environment changes. Therefore, detecting NCTC is a challenging task. In this paper, an NCTC detection method based on threshold secret sharing is proposed. The new approach utilizes the principle of threshold secret sharing to tolerate the loss or the destruction of partial subsecrets, improves the robustness of the detection method, and solves the problem that the current detection method cannot resist environment changes. Experimental results show that the proposed scheme in this paper has strong robustness to a changing network environment such as when network jitter, packet loss, and packet injection occur in the network transmission process. The approach can detect varieties of NCTCs with a guaranteed true positive rate and greatly improve the versatility and robustness.

A Wireless Covert Channel Based on Constellation Shaping Modulation

Wireless covert channel is an emerging covert communication technique which conceals the very existence of secret information in wireless signal including GSM, CDMA, and LTE. The secret message bits are always modulated into artificial noise superposed with cover signal, which is then demodulated with the shared codebook at the receiver. In this paper, we first extend the traditional KS test and regularity test in covert timing channel detection into wireless covert channel, which can be used to reveal the very existence of secret data in wireless covert channel from the aspect of multiorder statistics. In order to improve the undetectability, a wireless covert channel for OFDM-based communication system based on constellation shaping modulation is proposed, which generates additional constellation points around the standard points in normal constellations. The carrier signal is then modulated with the dirty constellation and the secret message bits are represented by the selection mode of the additional constellation points; shaping modulation is employed to keep the distribution of constellation errors unchanged. Experimental results show that the proposed wireless covert channel scheme can resist various statistical detections. The communication reliability under typical interference is also proved.

Towards a Reliable Detection of Covert Timing Channels over Real-Time Network Traffic

Inter-packet delays (IPD) of legitimate network traffic can be exploited for information hiding purposes and distribution of secret and sensitive data. This process is known as Covert Timing Channel (CTC), which is usually used for malicious purposes. In this paper we propose a novel approach, CTC Real-Time Detection (CTCRTD) to detect such activities based on IPD distributions of network traffic. We present and leverage three different non-parametric statistical tests that can be used to generate distinct statistical test scores for overt and covert traffic IPDs. Our new detection approach is designed around two major benefits: First, the new detection approach can detect various CTC algorithms that have similar impact on network traffic IPD distributions. Second, our detection approach reliably detects covert communication over real-time network traffic with minimal lag between the start of covert activity and the point of detection. We have evaluated and verified the reliability and effectiveness of our detection approach utilizing a large number of overt and covert traffic streams and various scenarios of the proposed detection technique. The obtained results show that the new detection approach can precisely differentiate between overt and covert network traffic and detect covert communication activities over 90 percent of time on average.

Analytic Study of Features for the Detection of Covert Timing Channels in NetworkTraffic

Analytic Study of Features for the Detection of Covert Timing Channels in NetworkTraffic

A Support Vector Machine-Based Framework for Detection of Covert Timing Channels

Covert channels exploit side channels within existing network resources to transmit secret messages. They are integrated into the elements of network resources that were not even designed for the purpose of communication. This means that traditional security features like firewalls cannot detect them. Their ability to evade detection makes covert channels a grave security concern. Hence, it is imperative to detect and disrupt them. However, a generic mechanism that can be used to detect a large variety of covert channels is missing. In this paper, we propose a support vector machine (SVM)-based framework for reliable detection of covert communications. The machine learning framework utilizes the fingerprints derived from the traffic under investigation to classify the traffic as covert or overt. We trained our classifier using the fingerprints from four popular and diverse covert timing channel algorithms and tested each of them independently. We have shown that the machine learning framework has great potential to blindly detect covert channels, even when the covert message size is reduced.

A Timing Channel Spyware for the CSMA/CA Protocol

This paper presents the design and implementation of spyware communication circuits built into the widely used carrier sense multiple access with collision avoidance (CSMA/CA) protocol. The spyware components are embedded within the sequential and combinational communication circuit structure during synthesis, rendering the distinction or dissociation of the spyware from the original circuit impossible. We take advantage of the timing channel resulting from transmission of packets to implement a new practical coding scheme that covertly transfers the spied data. Our codes are robust against the CSMA/CA's random retransmission time for collision avoidance and in fact take advantage of it to disguise the covert communication. The data snooping may be sporadically triggered, either externally or internally. The occasional trigger and the real-time traffic's variability make the spyware timing covert channel detection a challenge. The spyware is implemented and tested on a widely used open-source wireless CSMA/CA radio platform. We identify the following performance metrics and evaluate them on our architecture: 1) efficiency of implementation of the encoder; 2) robustness of the communication scheme to heterogeneous CSMA/CA effects; and 3) difficulty of covert channel detection. We evaluate criterion 1) completely theoretically. Criterion 2) is evaluated by simulating a wireless CSMA/CA architecture and testing the robustness of the decoder in different heterogeneous wireless conditions. Criterion 3) is confirmed experimentally using the state-of-the-art covert timing channel detection methods.

An Entropy-Based Approach to Detecting Covert Timing Channels

The detection of covert timing channels is of increasing interest in light of recent exploits of covert timing channels over the Internet. However, due to the high variation in legitimate network traffic, detecting covert timing channels is a challenging task. Existing detection schemes are ineffective at detecting most of the covert timing channels known to the security community. In this paper, we introduce a new entropy-based approach to detecting various covert timing channels. Our new approach is based on the observation that the creation of a covert timing channel has certain effects on the entropy of the original process, and hence, a change in the entropy of a process provides a critical clue for covert timing channel detection. Exploiting this observation, we investigate the use of entropy and conditional entropy in detecting covert timing channels. Our experimental results show that our entropy-based approach is sensitive to the current covert timing channels and is capable of detecting them in an accurate manner.

Liquid: A detection-resistant covert timing channel based on IPD shaping

Covert timing channels provide a way to surreptitiously leak information from an entity in a higher-security level to an entity in a lower level. The difficulty of detecting or eliminating such channels makes them a desirable choice for adversaries that value stealth over throughput. When one considers the possibility of such channels transmitting information across network boundaries, the threat becomes even more acute. A promising technique for detecting covert timing channels focuses on using entropy-based tests. This method is able to reliably detect known covert timing channels by using a combination of entropy and conditional entropy to detect anomalies in shape and regularity, respectively. This dual approach is intended to make entropy-based detection robust against both current and future channels. In this work, we show that entropy-based detection can be defeated by a channel that intelligently and adaptively manipulates the metrics used for detection. Specifically, we propose a new passive covert channel that uses a portion of the inter-packet delays in a compromised stream to smooth out the shape distortions detected by the entropy test. As a passive channel, it is not as prone to regularity-based detection as previously proposed active channels. We introduce a model for analyzing the effect of our techniques on the entropy of the channel and empirically investigate the accuracy of the model. In network experiments and simulation, we validate this model and demonstrate that the proposed channel successfully evades entropy-based detection and other known tests while maintaining reasonable throughput.